Suspected cyberattacks disrupted supermarket refrigeration systems across at least eight European countries on Monday, forcing retailers to discard food after hackers allegedly raised freezer temperatures to 50 °C.
Stores in Sweden, Finland, Belgium, Luxembourg, Ireland, Estonia and the Netherlands reported incidents, weeks after similar attacks affected hundreds of supermarkets in France.
Add Helsinki Times as a preferred source on Google (opens Google in a new tab)
In Belgium, around 40 Delhaize supermarkets experienced refrigeration failures, alongside 15 Carrefour outlets and five Spar stores. Ahold Delhaize also confirmed disruptions at stores in Luxembourg.
Belgian refrigeration company Sabcobel said attackers had accessed cooling systems and switched evaporators into defrost mode, causing temperatures to rise.
“We spent all night and morning disconnecting the affected installations from the grid,” Sabcobel chief executive Stephan Moelans told Belgian newspaper Le Soir.
According to Het Laatste Nieuws, a Delhaize supermarket in Hoeilaart, Belgium, estimated its food losses at €100,000, excluding further losses associated with closing the store.
Carrefour said the incidents affected 15 of its 700 Belgian stores and that staff had taken measures to maintain operations.
In Sweden, supermarket chains ICA and Coop reported disruptions at several locations. One ICA store in Sjöbo said attackers had remotely changed refrigeration settings to 50 °C, forcing employees to remove spoiled products.
 |
| Employees throw food that is spoiled or risks being spoiled into a large container outside the ICA Kvantum supermarket in Sjoebo, Sweden on November 2, 2026 after a hacker attack raised the temperature in the freezers to 50 degrees Celcius. Photo: Johan Nilsson / TT NEWS AGENCY / AFP / Lehtikuva |
At ICA Baronen in Stockholm, staff discovered the disruption at approximately 5.30am, three and a half hours after the suspected attack began, Reuters reported.
Coop confirmed to the BBC that seven of its approximately 800 Swedish stores were affected and said the situation was under control.
Finland’s National Cyber Security Centre also confirmed several suspected attacks. Specialist Juha Tretjakov told Ilta-Sanomat that authorities had received reports of successful intrusions and limited damage.
Finnish retailer Kesko reported temperature disturbances at several smaller K-market stores whose refrigeration systems operated outside its central security network.
Kesko security manager Petri Käyhkö said investigators had not ruled out interference through internet connections.
Stores in Helsinki’s Lönkan Herkku and Lauttasaari districts reported refrigeration problems. Their operators said the equipment had returned to normal operation.
In Ireland, 13 SuperValu supermarkets experienced refrigeration disruptions. Musgrave Group told The Irish Times that the incidents involved a particular refrigerator model.
Dutch broadcaster NOS reported that at least 17 businesses in the Netherlands, including butchers and neighbourhood shops, had suffered similar attacks, citing Danish equipment manufacturer Danfoss.
Estonian broadcaster ERR reported that a Selver supermarket was affected, with refrigeration temperatures reaching 50 °C.
The incidents follow October attacks against French supermarkets, where hackers reportedly manipulated cooling systems at hundreds of stores.
French police investigated attacks involving refrigeration controllers supplied mainly by Danfoss. Retailers reported substantial food losses, with some individual stores losing more than €100,000 in stock.
Finnish cybersecurity officials said they had identified several dozen Danfoss refrigeration controllers accessible through the public internet following the French incidents. Authorities contacted equipment owners to secure the systems.
Sabcobel said securing affected equipment sometimes required physical modifications rather than software updates alone.
Sweden’s national cybersecurity centre said it was investigating the incidents and had previously warned about industrial control equipment exposed to the internet.
Cybersecurity adviser Fredrik Blix told Swedish broadcaster SVT that investigators had not established whether the attacks involved a single group. He also cautioned that suggestions of state involvement remained speculation.
No organisation has claimed responsibility for the attacks, and authorities have not established whether the incidents across Europe share a common perpetrator.
HT
